The rapid increase in the use of online services for shopping, banking and other financial transactions has brought with it an increase in identity theft and fraud. The most common existing security techniques rely on the user having a password associated with an online identity (user name). However, schemes such as keystroke logging, phishing and similar techniques are used to improperly record or intercept passwords and the associated user names. Thus, the username/password data can be taken and used in fraudulent transactions, leading to loss of money, loss of time and loss of reputation, not only for the user whose identity was taken, but also for those parties who were fraudulently induced into believing they were transacting with the user.
The flaws in the username/password system have lead to the development of two-factor (also known as “strong”) authentication systems. Two-factor authentication is based on two elements: 1) something the user knows (i.e. a password or PIN); and 2) something the user has (an authenticator, often a physical device referred to as a “fob”). The fob and the password are used together to provide an additional level of security, as either one, individually, is of no use without the other.
Despite the improved security, two-factor authentication is still of limited use due to the requirement of the hardware fob. Furthermore, each secure system requires its own fob, creating a problem for the user who then needs to keep track of the multiple fobs necessary for access to multiple services.
One method of two-factor authentication is the use of One-Time Password (OTP) authentication. Using OTP authentication, a new OTP value (OTP token) is generated for use on a per-event basis (e.g. each remote logon attempt) or on a time-window basis (e.g. once per minute). The user is typically required to use a fob, either to generate the OTP, or to contact the system and receive the OTP.
Ideally, the fob can be replaced by another device already carried by the user, such as a mobile phone or PDA, which stores a set of OTP credentials for use when access the secure system. However, this creates a new problem that must be addressed, namely, the requirement that the OTP credentials be properly encrypted and bound to the device.